Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 7, 2021, 5:17 p.m.	Nov. 7, 2021, 5:19 p.m.

Size	985.6KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`cf3fa87cfc679bddbfb4ec26b06e7f7d`
SHA256	`a233093d08eb2f93b8a3371821c4ac3026282fb7d2ea0138f7d9d18d951b62b0`
CRC32	`6544E1FF`
ssdeep	`12288:iP/VdOzpdRWlrSxzgjHsCcd2Ebq7UJkSqitKMY2CgolpS6zgyPwq2NApx944ATah:myDRWlsgoRWgJFqitKM2bze4ZjAzvDyP`
PDB Path	D:\v2.0\A2\_work\59\obj\Release.AnyCPU\Vssf.Client\MS.VS.Services.Common\Microsoft.VisualStudio.Services.Common.pdb
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

210.exe "C:\Users\test22\AppData\Local\Temp\210.exe"
2768
- AdvancedRun.exe "C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2872
- AdvancedRun.exe "C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2880
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force
  2976
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force
  3064
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force
  1304
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force
  2232
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force
  2288
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force
  2476
- breakers.exe "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe"
  2600
  - AdvancedRun.exe "C:\Users\test22\AppData\Local\Temp\6332e2a5-bea0-4715-bca2-9fa2be51cd3d\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\6332e2a5-bea0-4715-bca2-9fa2be51cd3d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    788
  - AdvancedRun.exe "C:\Users\test22\AppData\Local\Temp\40c93470-5275-4068-a320-c58589917a36\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\40c93470-5275-4068-a320-c58589917a36\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    2304
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force
    3700
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force
    3764
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force
    3824
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\roughhouse\svchost.exe" -Force
    3892
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force
    3968
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\roughhouse\svchost.exe" -Force
    1784
  - aspnet_regsql.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
    3304
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\roughhouse\svchost.exe" -Force
  2740
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force
  1668
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\roughhouse\svchost.exe" -Force
  2460
- jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  3376

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
109.107.191.37	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 112 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 7, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (23 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Nov. 7, 2021, 5:17 p.m.			0	0

Command line console output was observed (50 out of 135 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\210. console_handle: 0x00000053	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\210. console_handle: 0x00000053	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\210. console_handle: 0x00000053	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\Microso console_handle: 0x00000053	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: ft\Windows\Start Menu\Programs\Startup\breakers.exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Roaming\Microso console_handle: 0x00000053	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: ft\Windows\Start Menu\Programs\Startup\breakers.exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 7, 2021, 5:17 p.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\210. console_handle: 0x00000053	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 770 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b060 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b060 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b060 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b060 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b0e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b0e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afe0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afe0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054afe0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b320 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b360 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0054b360 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331968 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331ee8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331ee8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331ee8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003320e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003320e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003320e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003320e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003320e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003320e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331928 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331928 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331928 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331ee8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331ee8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331ee8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331ee8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331ee8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331ee8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331ee8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331ee8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331ee8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00331ee8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00332268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00332268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00332268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00332268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00332268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00332268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00332268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00332268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00332268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00332268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00332268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00332268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00332268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 7, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00332268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

D:\v2.0\A2\_work\59\obj\Release.AnyCPU\Vssf.Client\MS.VS.Services.Common\Microsoft.VisualStudio.Services.Common.pdb

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 7, 2021, 5:17 p.m.		1	1	0

One or more processes crashed (35 events)

Time & API	Arguments	Status
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x925d46 0x92479a 0x924129 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d36ad @ 0x721436ad mscorlib+0x308f2d @ 0x72178f2d microsoft+0x50c17 @ 0x6f090c17 microsoft+0x3f33f @ 0x6f07f33f microsoft+0x3edf8 @ 0x6f07edf8 microsoft+0x3e3b9 @ 0x6f07e3b9 microsoft+0x17e980 @ 0x6f1be980 0x923163 0x9214fd 0x920226 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 39 09 e8 11 53 7c 71 c7 45 e8 00 00 00 00 c7 45 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x925dcc registers.esp: 3336444 registers.edi: 3336484 registers.eax: 0 registers.ebp: 3336496 registers.edx: 40047144 registers.ebx: 3337316 registers.esi: 40224564 registers.ecx: 0	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x925d58 0x92479a 0x924129 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d36ad @ 0x721436ad mscorlib+0x308f2d @ 0x72178f2d microsoft+0x50c17 @ 0x6f090c17 microsoft+0x3f33f @ 0x6f07f33f microsoft+0x3edf8 @ 0x6f07edf8 microsoft+0x3e3b9 @ 0x6f07e3b9 microsoft+0x17e980 @ 0x6f1be980 0x923163 0x9214fd 0x920226 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 39 09 e8 11 53 7c 71 c7 45 e8 00 00 00 00 c7 45 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x925dcc registers.esp: 3336444 registers.edi: 3336484 registers.eax: 0 registers.ebp: 3336496 registers.edx: 40224664 registers.ebx: 3337316 registers.esi: 40224564 registers.ecx: 0	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x575d46 0x57479a 0x574129 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d36ad @ 0x721436ad mscorlib+0x308f2d @ 0x72178f2d microsoft+0x50c17 @ 0x6f090c17 microsoft+0x3f33f @ 0x6f07f33f microsoft+0x3edf8 @ 0x6f07edf8 microsoft+0x3e3b9 @ 0x6f07e3b9 microsoft+0x17e980 @ 0x6f1be980 0x573163 0x5714fd 0x570226 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 39 09 e8 11 53 b7 71 c7 45 e8 00 00 00 00 c7 45 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x575dcc registers.esp: 4515980 registers.edi: 4516020 registers.eax: 0 registers.ebp: 4516032 registers.edx: 39981608 registers.ebx: 4516852 registers.esi: 40154636 registers.ecx: 0	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x575d58 0x57479a 0x574129 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d3711 @ 0x72143711 mscorlib+0x308f2d @ 0x72178f2d mscorlib+0x2cb060 @ 0x7213b060 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72e32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72eb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72eb1737 mscorlib+0x2d36ad @ 0x721436ad mscorlib+0x308f2d @ 0x72178f2d microsoft+0x50c17 @ 0x6f090c17 microsoft+0x3f33f @ 0x6f07f33f microsoft+0x3edf8 @ 0x6f07edf8 microsoft+0x3e3b9 @ 0x6f07e3b9 microsoft+0x17e980 @ 0x6f1be980 0x573163 0x5714fd 0x570226 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 39 09 e8 11 53 b7 71 c7 45 e8 00 00 00 00 c7 45 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x575dcc registers.esp: 4515980 registers.edi: 4516020 registers.eax: 0 registers.ebp: 4516032 registers.edx: 40154736 registers.ebx: 4516852 registers.esi: 40154636 registers.ecx: 0	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x6c58e2 0x6c585d 0x6c145c 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6c5971 registers.esp: 2486840 registers.edi: 39725844 registers.eax: 0 registers.ebp: 2486864 registers.edx: 7811280 registers.ebx: 37954516 registers.esi: 39726024 registers.ecx: 0	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x6c6a17 0x6c6959 0x6c606b 0x6c5c37 0x6c5a01 0x6c1487 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 b9 b8 76 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6c6e7f registers.esp: 2486572 registers.edi: 39930150 registers.eax: 0 registers.ebp: 2486620 registers.edx: 75566188 registers.ebx: 39930000 registers.esi: 39930220 registers.ecx: 75571536	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x6c6a17 0x6c6959 0x6c606b 0x6c5c37 0x6c5a01 0x6c1487 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 b9 b8 76 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6c6e7f registers.esp: 2486572 registers.edi: 40994962 registers.eax: 0 registers.ebp: 2486620 registers.edx: 75566188 registers.ebx: 40994812 registers.esi: 40995032 registers.ecx: 75571536	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x6c6a17 0x6c6959 0x6c606b 0x6c5c37 0x6c5a01 0x6c1487 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 b9 b8 76 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6c6e7f registers.esp: 2486572 registers.edi: 42034898 registers.eax: 0 registers.ebp: 2486620 registers.edx: 75566188 registers.ebx: 42034748 registers.esi: 42034968 registers.ecx: 75571536	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x6c8896 0x6c87e9 0x6c60f8 0x6c5c37 0x6c5a01 0x6c1487 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 b9 b8 76 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6c6e7f registers.esp: 2486564 registers.edi: 39504470 registers.eax: 0 registers.ebp: 2486612 registers.edx: 75566188 registers.ebx: 39504320 registers.esi: 39504540 registers.ecx: 75571536	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x6c8896 0x6c87e9 0x6c60f8 0x6c5c37 0x6c5a01 0x6c1487 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 b9 b8 76 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6c6e7f registers.esp: 2486564 registers.edi: 40624034 registers.eax: 0 registers.ebp: 2486612 registers.edx: 75566188 registers.ebx: 40623884 registers.esi: 40624104 registers.ecx: 75571536	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x6c8896 0x6c87e9 0x6c60f8 0x6c5c37 0x6c5a01 0x6c1487 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 b9 b8 76 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6c6e7f registers.esp: 2486564 registers.edi: 39584866 registers.eax: 0 registers.ebp: 2486612 registers.edx: 75566188 registers.ebx: 39584716 registers.esi: 39584936 registers.ecx: 75571536	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x6c8da5 0x6c8cf9 0x6c6170 0x6c5c37 0x6c5a01 0x6c1487 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 b9 b8 76 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6c6e7f registers.esp: 2486568 registers.edi: 40704522 registers.eax: 0 registers.ebp: 2486616 registers.edx: 75566188 registers.ebx: 40704372 registers.esi: 40704592 registers.ecx: 75571536	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x6c8da5 0x6c8cf9 0x6c6170 0x6c5c37 0x6c5a01 0x6c1487 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 b9 b8 76 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6c6e7f registers.esp: 2486568 registers.edi: 41883242 registers.eax: 0 registers.ebp: 2486616 registers.edx: 75566188 registers.ebx: 41883092 registers.esi: 41883312 registers.ecx: 75571536	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x6c8da5 0x6c8cf9 0x6c6170 0x6c5c37 0x6c5a01 0x6c1487 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 b9 b8 76 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6c6e7f registers.esp: 2486568 registers.edi: 43061962 registers.eax: 0 registers.ebp: 2486616 registers.edx: 75566188 registers.ebx: 43061812 registers.esi: 43062032 registers.ecx: 75571536	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x6c9195 0x6c90e9 0x6c61de 0x6c5c37 0x6c5a01 0x6c1487 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 b9 b8 76 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6c6e7f registers.esp: 2486568 registers.edi: 39464602 registers.eax: 0 registers.ebp: 2486616 registers.edx: 75566188 registers.ebx: 39464452 registers.esi: 39464672 registers.ecx: 75571536	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x6c9195 0x6c90e9 0x6c61de 0x6c5c37 0x6c5a01 0x6c1487 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 b9 b8 76 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6c6e7f registers.esp: 2486568 registers.edi: 40645442 registers.eax: 0 registers.ebp: 2486616 registers.edx: 75566188 registers.ebx: 40645292 registers.esi: 40645512 registers.ecx: 75571536	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x6c9195 0x6c90e9 0x6c61de 0x6c5c37 0x6c5a01 0x6c1487 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 b9 b8 76 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6c6e7f registers.esp: 2486568 registers.edi: 41826282 registers.eax: 0 registers.ebp: 2486616 registers.edx: 75566188 registers.ebx: 41826132 registers.esi: 41826352 registers.ecx: 75571536	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72fe1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72eb2ba1 mscorlib+0x36dd3a @ 0x721ddd3a mscorlib+0x32fea6 @ 0x7219fea6 mscorlib+0x30ab40 @ 0x7217ab40 0x6c7229 0x6cd550 0x6cd0db 0x6ccb57 0x6c1487 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x760cb727 registers.esp: 2486340 registers.edi: 0 registers.eax: 2486340 registers.ebp: 2486420 registers.edx: 0 registers.ebx: 7788704 registers.esi: 7811280 registers.ecx: 3351146837	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72fe1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72eb2ba1 mscorlib+0x36dd51 @ 0x721ddd51 mscorlib+0x32fea6 @ 0x7219fea6 mscorlib+0x30ab40 @ 0x7217ab40 0x6c7229 0x6cd550 0x6cd0db 0x6ccb57 0x6c1487 0x6c11b0 0x6c0056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x760cb727 registers.esp: 2486340 registers.edi: 0 registers.eax: 2486340 registers.ebp: 2486420 registers.edx: 0 registers.ebx: 7788704 registers.esi: 7811280 registers.ecx: 3351146837	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x65553a 0x6554b5 0x65145c 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6555c9 registers.esp: 3075816 registers.edi: 36671384 registers.eax: 0 registers.ebp: 3075840 registers.edx: 6844808 registers.ebx: 35529764 registers.esi: 36671564 registers.ecx: 0	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72fe1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72eb2ba1 mscorlib+0x36dd51 @ 0x721ddd51 mscorlib+0x32fea6 @ 0x7219fea6 mscorlib+0x30ab40 @ 0x7217ab40 0x6575d9 0x657529 0x6570b3 0x656b2f 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x760cb727 registers.esp: 3075316 registers.edi: 0 registers.eax: 3075316 registers.ebp: 3075396 registers.edx: 0 registers.ebx: 6822376 registers.esi: 6844808 registers.ecx: 3694889914	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72fe1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72eb2ba1 mscorlib+0x316bae @ 0x72186bae mscorlib+0x32fddf @ 0x7219fddf mscorlib+0x30ab1e @ 0x7217ab1e 0x6575d9 0x657529 0x6570b3 0x656b2f 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x760cb727 registers.esp: 3075372 registers.edi: 0 registers.eax: 3075372 registers.ebp: 3075452 registers.edx: 0 registers.ebx: 6822376 registers.esi: 6844808 registers.ecx: 3694889970	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x72fe1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x72eb2ba1 mscorlib+0x36dd51 @ 0x721ddd51 mscorlib+0x32fea6 @ 0x7219fea6 mscorlib+0x30ab40 @ 0x7217ab40 0x6575d9 0x657529 0x6570b3 0x656b2f 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x760cb727 registers.esp: 3075316 registers.edi: 0 registers.eax: 3075316 registers.ebp: 3075396 registers.edx: 0 registers.ebx: 6822376 registers.esi: 6844808 registers.ecx: 3694889914	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x65a8b7 0x65a7f9 0x659f03 0x659ac7 0x655a19 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 19 7a 7d 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x65ad1f registers.esp: 3075548 registers.edi: 38708562 registers.eax: 0 registers.ebp: 3075596 registers.edx: 84486364 registers.ebx: 38708412 registers.esi: 38708632 registers.ecx: 84491712	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x65a8b7 0x65a7f9 0x659f03 0x659ac7 0x655a19 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 19 7a 7d 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x65ad1f registers.esp: 3075548 registers.edi: 39770482 registers.eax: 0 registers.ebp: 3075596 registers.edx: 84486364 registers.ebx: 39770332 registers.esi: 39770552 registers.ecx: 84491712	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x65a8b7 0x65a7f9 0x659f03 0x659ac7 0x655a19 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 19 7a 7d 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x65ad1f registers.esp: 3075548 registers.edi: 42114926 registers.eax: 0 registers.ebp: 3075596 registers.edx: 84486364 registers.ebx: 42114776 registers.esi: 42114996 registers.ecx: 84491712	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x65c606 0x65c559 0x659f90 0x659ac7 0x655a19 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 19 7a 7d 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x65ad1f registers.esp: 3075540 registers.edi: 43153946 registers.eax: 0 registers.ebp: 3075588 registers.edx: 84486364 registers.ebx: 43153796 registers.esi: 43154016 registers.ecx: 84491712	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x65c606 0x65c559 0x659f90 0x659ac7 0x655a19 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 19 7a 7d 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x65ad1f registers.esp: 3075540 registers.edi: 36708910 registers.eax: 0 registers.ebp: 3075588 registers.edx: 84486364 registers.ebx: 36708760 registers.esi: 36708980 registers.ecx: 84491712	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x65c606 0x65c559 0x659f90 0x659ac7 0x655a19 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 19 7a 7d 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x65ad1f registers.esp: 3075540 registers.edi: 37839630 registers.eax: 0 registers.ebp: 3075588 registers.edx: 84486364 registers.ebx: 37839480 registers.esi: 37839700 registers.ecx: 84491712	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x65cb15 0x65ca69 0x65a008 0x659ac7 0x655a19 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 19 7a 7d 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x65ad1f registers.esp: 3075544 registers.edi: 36777770 registers.eax: 0 registers.ebp: 3075592 registers.edx: 84486364 registers.ebx: 36777620 registers.esi: 36777840 registers.ecx: 84491712	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x65cb15 0x65ca69 0x65a008 0x659ac7 0x655a19 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 19 7a 7d 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x65ad1f registers.esp: 3075544 registers.edi: 37987058 registers.eax: 0 registers.ebp: 3075592 registers.edx: 84486364 registers.ebx: 37986908 registers.esi: 37987128 registers.ecx: 84491712	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x65cb15 0x65ca69 0x65a008 0x659ac7 0x655a19 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 19 7a 7d 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x65ad1f registers.esp: 3075544 registers.edi: 36660954 registers.eax: 0 registers.ebp: 3075592 registers.edx: 84486364 registers.ebx: 36660804 registers.esi: 36661024 registers.ecx: 84491712	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x65cf05 0x65ce59 0x65a076 0x659ac7 0x655a19 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 19 7a 7d 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x65ad1f registers.esp: 3075544 registers.edi: 37851010 registers.eax: 0 registers.ebp: 3075592 registers.edx: 84486364 registers.ebx: 37850860 registers.esi: 37851080 registers.ecx: 84491712	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x65cf05 0x65ce59 0x65a076 0x659ac7 0x655a19 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 19 7a 7d 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x65ad1f registers.esp: 3075544 registers.edi: 39031850 registers.eax: 0 registers.ebp: 3075592 registers.edx: 84486364 registers.ebx: 39031700 registers.esi: 39031920 registers.ecx: 84491712	1
__exception__ Nov. 7, 2021, 5:17 p.m.	stacktrace: 0x65cf05 0x65ce59 0x65a076 0x659ac7 0x655a19 0x651487 0x6511b0 0x650056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72e4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72e42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72ef74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72ef7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72f81dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72f81e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72f81f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72f8416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7488f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74907f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74904de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: 8b 40 04 89 45 d4 eb 11 e8 19 7a 7d 72 eb 0a e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x65ad1f registers.esp: 3075544 registers.edi: 40212690 registers.eax: 0 registers.ebp: 3075592 registers.edx: 84486364 registers.ebx: 40212540 registers.esi: 40212760 registers.ecx: 84491712	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 2243 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00330000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00360000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e31000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e32000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00487000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00485000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00921000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00922000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00476000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00477000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00923000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00924000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00925000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00926000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00927000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00928000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ee000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00929000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02910000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6d7b1000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0263a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6d7b2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02632000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02642000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0266a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02643000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02644000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0263b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02662000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02645000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0266c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data

Foreign language identified in PE resource (1 event)

name

RT_VERSION

language

LANG_ENGLISH

filetype

data

sublanguage

SUBLANG_ENGLISH_AUS

offset

0x000f80f0

size

0x00000334

Creates executable files on the filesystem (8 events)

file	C:\Users\test22\AppData\Local\Temp\40c93470-5275-4068-a320-c58589917a36\AdvancedRun.exe
file	C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\AdvancedRun.exe
file	C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\test.bat
file	C:\Users\test22\AppData\Local\Temp\40c93470-5275-4068-a320-c58589917a36\test.bat
file	C:\Users\test22\AppData\Local\Temp\6332e2a5-bea0-4715-bca2-9fa2be51cd3d\AdvancedRun.exe
file	C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\test.bat
file	C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\AdvancedRun.exe
file	C:\Users\test22\AppData\Local\Temp\6332e2a5-bea0-4715-bca2-9fa2be51cd3d\test.bat

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (7 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force
cmdline	C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\roughhouse\svchost.exe" -Force
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\roughhouse\svchost.exe" -Force
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force
cmdline	powershell Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\AdvancedRun.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\AdvancedRun.exe

A process created a hidden window (19 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\AdvancedRun.exe parameters: /EXEFilename "C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run filepath: C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\AdvancedRun.exe	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\AdvancedRun.exe parameters: /EXEFilename "C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run filepath: C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\AdvancedRun.exe	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force filepath: powershell	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force filepath: powershell	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force filepath: powershell	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force filepath: powershell	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force filepath: powershell	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force filepath: powershell	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\roughhouse\svchost.exe" -Force filepath: powershell	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force filepath: powershell	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\roughhouse\svchost.exe" -Force filepath: powershell	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\6332e2a5-bea0-4715-bca2-9fa2be51cd3d\AdvancedRun.exe parameters: /EXEFilename "C:\Users\test22\AppData\Local\Temp\6332e2a5-bea0-4715-bca2-9fa2be51cd3d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run filepath: C:\Users\test22\AppData\Local\Temp\6332e2a5-bea0-4715-bca2-9fa2be51cd3d\AdvancedRun.exe	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\40c93470-5275-4068-a320-c58589917a36\AdvancedRun.exe parameters: /EXEFilename "C:\Users\test22\AppData\Local\Temp\40c93470-5275-4068-a320-c58589917a36\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run filepath: C:\Users\test22\AppData\Local\Temp\40c93470-5275-4068-a320-c58589917a36\AdvancedRun.exe	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force filepath: powershell	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force filepath: powershell	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force filepath: powershell	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\roughhouse\svchost.exe" -Force filepath: powershell	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force filepath: powershell	1	1
ShellExecuteExW Nov. 7, 2021, 5:17 p.m.	show_type: 0 filepath_r: powershell parameters: Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\roughhouse\svchost.exe" -Force filepath: powershell	1	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (43 events)

Time & API	Arguments	Status	Return
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: lsass.exe process_identifier: 452	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: lsm.exe process_identifier: 460	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: svchost.exe process_identifier: 580	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: svchost.exe process_identifier: 656	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: svchost.exe process_identifier: 728	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: svchost.exe process_identifier: 836	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: audiodg.exe process_identifier: 916	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: svchost.exe process_identifier: 988	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: svchost.exe process_identifier: 304	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: svchost.exe process_identifier: 1044	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: svchost.exe process_identifier: 1340	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: srvany.exe process_identifier: 1380	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: KMService.exe process_identifier: 1452	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: conhost.exe process_identifier: 1468	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: sppsvc.exe process_identifier: 1716	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: svchost.exe process_identifier: 1804	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: dwm.exe process_identifier: 2028	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: explorer.exe process_identifier: 1156	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: SearchIndexer.exe process_identifier: 772	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: SearchProtocolHost.exe process_identifier: 1776	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: SearchFilterHost.exe process_identifier: 1492	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: mobsync.exe process_identifier: 2348	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: pw.exe process_identifier: 2516	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: 210.exe process_identifier: 2768	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: AdvancedRun.exe process_identifier: 2880	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: schtasks.exe process_identifier: 2952	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: conhost.exe process_identifier: 2960	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: powershell.exe process_identifier: 3064	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: conhost.exe process_identifier: 1992	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: powershell.exe process_identifier: 1304	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: conhost.exe process_identifier: 2172	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: powershell.exe process_identifier: 2232	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: powershell.exe process_identifier: 2288	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: conhost.exe process_identifier: 192	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: powershell.exe process_identifier: 2476	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: conhost.exe process_identifier: 2628	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: powershell.exe process_identifier: 2740	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: powershell.exe process_identifier: 1668	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: AdvancedRun.exe process_identifier: 788	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: powershell.exe process_identifier: 2460	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: conhost.exe process_identifier: 2984	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: cmd.exe process_identifier: 1840	1	1
Process32NextW Nov. 7, 2021, 5:17 p.m.	snapshot_handle: 0x00000108 process_name: conhost.exe process_identifier: 832	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000f4800', u'virtual_address': u'0x00002000', u'entropy': 6.919390100318595, u'name': u'.text', u'virtual_size': u'0x000f47e7'}

entropy

6.91939010032

description

A section with a high entropy has been found

entropy

0.997450280469

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (23 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Nov. 7, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (16 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (50 out of 78 events)

Time & API	Arguments	Status
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000001fc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: AddressBook base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: Connection Manager base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: DirectDrawEx base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: EditPlus base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: ENTERPRISE base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: Fontcore base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: Google Chrome base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: IE40 base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: IE4Data base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: IE5BAKEX base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: IEData base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: MobileOptionPack base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: SchedulingAgent base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: WIC base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: {d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x000001fc key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: AddressBook base_handle: 0x00000200 key_handle: 0x0000036c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: Connection Manager base_handle: 0x00000200 key_handle: 0x0000036c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: DirectDrawEx base_handle: 0x00000200 key_handle: 0x0000036c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: EditPlus base_handle: 0x00000200 key_handle: 0x0000036c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: ENTERPRISE base_handle: 0x00000200 key_handle: 0x0000036c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: Fontcore base_handle: 0x00000200 key_handle: 0x0000036c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: Google Chrome base_handle: 0x00000200 key_handle: 0x0000036c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000200 key_handle: 0x0000036c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: IE40 base_handle: 0x00000200 key_handle: 0x0000036c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Nov. 7, 2021, 5:17 p.m.	regkey_r: IE4Data base_handle: 0x00000200 key_handle: 0x0000036c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1

Created a process named as a common system process (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 2444 thread_handle: 0x000004bc process_identifier: 2172 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000004c0	1	1	0

Uses Windows utilities for basic Windows functionality (9 events)

cmdline	C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\AdvancedRun.exe /EXEFilename "C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
cmdline	C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\AdvancedRun.exe /EXEFilename "C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
cmdline	C:\Users\test22\AppData\Local\Temp\40c93470-5275-4068-a320-c58589917a36\AdvancedRun.exe /EXEFilename "C:\Users\test22\AppData\Local\Temp\40c93470-5275-4068-a320-c58589917a36\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
cmdline	"C:\Users\test22\AppData\Local\Temp\6332e2a5-bea0-4715-bca2-9fa2be51cd3d\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\6332e2a5-bea0-4715-bca2-9fa2be51cd3d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
cmdline	"C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
cmdline	"C:\Users\test22\AppData\Local\Temp\40c93470-5275-4068-a320-c58589917a36\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\40c93470-5275-4068-a320-c58589917a36\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
cmdline	"C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
cmdline	C:\Users\test22\AppData\Local\Temp\6332e2a5-bea0-4715-bca2-9fa2be51cd3d\AdvancedRun.exe /EXEFilename "C:\Users\test22\AppData\Local\Temp\6332e2a5-bea0-4715-bca2-9fa2be51cd3d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
cmdline	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Communicates with host for which no DNS query was performed (1 event)

host

109.107.191.37

Allocates execute permission to another process indicative of possible code injection (5 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 3220 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000058c		3221225496
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 3376 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000049c	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2804 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004d8		3221225496
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2488 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000045c		3221225496
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 3304 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004cc	1	0

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\breakers				reg_value	C:\Program Files\Common Files\System\roughhouse\svchost.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\breakers				reg_value	C:\Program Files\Common Files\System\roughhouse\svchost.exe

Deletes executed files from disk (2 events)

file	C:\Users\test22\AppData\Local\Temp\6332e2a5-bea0-4715-bca2-9fa2be51cd3d\test.bat
file	C:\Users\test22\AppData\Local\Temp\6332e2a5-bea0-4715-bca2-9fa2be51cd3d\AdvancedRun.exe

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Manipulates memory of a non-child process indicative of process injection (6 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 2768 manipulating memory of non-child process 3220
Process injection	Process 2600 manipulating memory of non-child process 2804
Process injection	Process 2600 manipulating memory of non-child process 2488
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 3220 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000058c	3221225496	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2804 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004d8	3221225496	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 2488 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000045c	3221225496	0

Potential code injection by writing to the memory of another process (8 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¹å+õà0: À@ 5L@èOÀÜèàÌ H.text° `.rsrcÜÀ@@.relocà@B base_address: 0x00400000 process_identifier: 3376 process_handle: 0x0000049c	1	1
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: P8hÜÀLL4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¬StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0: InternalNameMinority.exe(LegalCopyright B OriginalFilenameMinority.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ìÂêï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0041c000 process_identifier: 3376 process_handle: 0x0000049c	1	1
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: <= base_address: 0x0041e000 process_identifier: 3376 process_handle: 0x0000049c	1	1
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3376 process_handle: 0x0000049c	1	1
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¹å+õà0: À@ 5L@èOÀÜèàÌ H.text° `.rsrcÜÀ@@.relocà@B base_address: 0x00400000 process_identifier: 3304 process_handle: 0x000004cc	1	1
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: P8hÜÀLL4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¬StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0: InternalNameMinority.exe(LegalCopyright B OriginalFilenameMinority.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ìÂêï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0041c000 process_identifier: 3304 process_handle: 0x000004cc	1	1
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: <= base_address: 0x0041e000 process_identifier: 3304 process_handle: 0x000004cc	1	1
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3304 process_handle: 0x000004cc	1	1

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¹å+õà0: À@ 5L@èOÀÜèàÌ H.text° `.rsrcÜÀ@@.relocà@B base_address: 0x00400000 process_identifier: 3376 process_handle: 0x0000049c	1	1	0
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¹å+õà0: À@ 5L@èOÀÜèàÌ H.text° `.rsrcÜÀ@@.relocà@B base_address: 0x00400000 process_identifier: 3304 process_handle: 0x000004cc	1	1	0

Collects information about installed applications (50 out of 54 events)

Time & API	Arguments	Status
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 7, 2021, 5:17 p.m.	key_handle: 0x0000036c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1

File has been identified by 14 AntiVirus engines on VirusTotal as malicious (14 events)

Lionic	Trojan.MSIL.Stealer.l!c
Cylance	Unsafe
Symantec	ML.Attribute.HighConfidence
Paloalto	generic.ml
Kaspersky	UDS:Trojan-Spy.MSIL.Stealer.gen
Avast	FileRepMalware
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:MSIL/RedLine.RPS!MTB
McAfee	Artemis!CF3FA87CFC67
Malwarebytes	Malware.AI.2327626456
Fortinet	MSIL/GenKryptik.FNAV!tr
AVG	FileRepMalware

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2768 called NtSetContextThread to modify thread in remote process 3376
Process injection	Process 2600 called NtSetContextThread to modify thread in remote process 3304
NtSetContextThread Nov. 7, 2021, 5:17 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4295994 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000464 process_identifier: 3376	1	0	0
NtSetContextThread Nov. 7, 2021, 5:17 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4295994 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000004c4 process_identifier: 3304	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2768 resumed a thread in remote process 3376
Process injection	Process 2600 resumed a thread in remote process 3304
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000464 suspend_count: 1 process_identifier: 3376	1	0	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x000004c4 suspend_count: 1 process_identifier: 3304	1	0	0

Creates known SpyNet files, registry changes and/or mutexes. (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Disables Windows Security features (5 events)

description	attempts to disable user access control	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection

Executed a process and injected code into it, probably while unpacking (50 out of 187 events)

Time & API	Arguments	Status	Return
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2768	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 2768	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 2768	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000250 suspend_count: 1 process_identifier: 2768	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 2768	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x0000027c suspend_count: 1 process_identifier: 2768	1	0
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 2876 thread_handle: 0x0000046c process_identifier: 2872 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\AdvancedRun.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run filepath_r: C:\Users\test22\AppData\Local\Temp\b3d89b7a-e884-4aff-9e60-4d489ee2afdb\AdvancedRun.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000468	1	1
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 2884 thread_handle: 0x00000484 process_identifier: 2880 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\AdvancedRun.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\AdvancedRun.exe" /EXEFilename "C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run filepath_r: C:\Users\test22\AppData\Local\Temp\adbeaacd-7843-45aa-95a5-e6ac121e9fca\AdvancedRun.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000478	1	1
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000440 suspend_count: 1 process_identifier: 2768	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000498 suspend_count: 1 process_identifier: 2768	1	0
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 2984 thread_handle: 0x000004e4 process_identifier: 2976 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004e8	1	1
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x000004e4 suspend_count: 1 process_identifier: 2768	1	0
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 3048 thread_handle: 0x000004d4 process_identifier: 3064 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004cc	1	1
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 900 thread_handle: 0x000003c8 process_identifier: 1304 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000484	1	1
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x000004dc suspend_count: 1 process_identifier: 2768	1	0
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 2264 thread_handle: 0x000003e0 process_identifier: 2232 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004d4	1	1
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x000004c0 suspend_count: 1 process_identifier: 2768	1	0
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 2336 thread_handle: 0x000004d4 process_identifier: 2288 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000510	1	1
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000504 suspend_count: 1 process_identifier: 2768	1	0
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 2488 thread_handle: 0x0000050c process_identifier: 2476 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000528	1	1
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000508 suspend_count: 1 process_identifier: 2768	1	0
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 2680 thread_handle: 0x0000051c process_identifier: 2600 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe" filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\breakers.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000053c	1	1
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x0000050c suspend_count: 1 process_identifier: 2768	1	0
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 2732 thread_handle: 0x00000544 process_identifier: 2740 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\roughhouse\svchost.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000558	1	1
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x0000054c suspend_count: 1 process_identifier: 2768	1	0
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 1988 thread_handle: 0x00000550 process_identifier: 1668 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\210.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000570	1	1
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000564 suspend_count: 1 process_identifier: 2768	1	0
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 2624 thread_handle: 0x0000056c process_identifier: 2460 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\roughhouse\svchost.exe" -Force filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000588	1	1
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 3224 thread_handle: 0x00000550 process_identifier: 3220 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000058c	1	1
NtGetContextThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000550	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 3220 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000058c		3221225496
CreateProcessInternalW Nov. 7, 2021, 5:17 p.m.	thread_identifier: 3380 thread_handle: 0x00000464 process_identifier: 3376 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000049c	1	1
NtGetContextThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000464	1	0
NtAllocateVirtualMemory Nov. 7, 2021, 5:17 p.m.	process_identifier: 3376 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000049c	1	0
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¹å+õà0: À@ 5L@èOÀÜèàÌ H.text° `.rsrcÜÀ@@.relocà@B base_address: 0x00400000 process_identifier: 3376 process_handle: 0x0000049c	1	1
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: base_address: 0x00402000 process_identifier: 3376 process_handle: 0x0000049c	1	1
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: P8hÜÀLL4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¬StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0: InternalNameMinority.exe(LegalCopyright B OriginalFilenameMinority.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ìÂêï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0041c000 process_identifier: 3376 process_handle: 0x0000049c	1	1
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: <= base_address: 0x0041e000 process_identifier: 3376 process_handle: 0x0000049c	1	1
WriteProcessMemory Nov. 7, 2021, 5:17 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3376 process_handle: 0x0000049c	1	1
NtSetContextThread Nov. 7, 2021, 5:17 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4295994 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000464 process_identifier: 3376	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000464 suspend_count: 1 process_identifier: 3376	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 2976	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2976	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 2976	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x000004a4 suspend_count: 1 process_identifier: 2976	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000294 suspend_count: 1 process_identifier: 3064	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 3064	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000444 suspend_count: 1 process_identifier: 3064	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x000004a4 suspend_count: 1 process_identifier: 3064	1	0
NtResumeThread Nov. 7, 2021, 5:17 p.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 1304	1	0

210.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All